1

This video https://youtube.com/watch?v=4HxUmbOcN6Y presents how modern compilers protect stack overflows with stack cookies and function __stack_chk_fail.

  1. How can one identify if a binary has stack smashing protection? If I see __stack_chk_fail in IDA can I guess that this binary uses stack cookies(I will see this function only if this binary compiled dynamically).

But if this function is compiled statically, how can I recognize it? Each function will end with if ... then abort else return or only functions that get buffer from user?

  1. If binary use stack smash protection and get buffer unsafe (like gets ) how can I get over stack cookies? Or there is no way to return to another function?
1
  1. You can identify if a function is protected by the presence of __stack_chk_fail. It doesn't matter if it's user-custom code or it is statically compiled from libraries.

  2. gets is a very problematic function by design. It's impossible to protect it from buffer overflows

For example:

int main()
{
    char buf[2000];
    gets(buf);
}

In this case, the stack protection will most likely be on the main function, because of the buf variable.

| improve this answer | |
  • 1. __stack_chk_fail it's part of libssp so if I compile it statically I will not see __stack_chk_fail in code. 2. If stack smash protection used and the code check the magic before return address in stack, how can I over write it and jump to another function even I use gets – wfj96649BcaooCom Dec 29 '19 at 13:08
  • 1. Compile statically means that the function resides within your compiled library, and not in an outside imported library. So it doesn't matter, you will still see a call to the function - once from within your file, and once as an import from outside. Don't be confused with inline – macro_controller Dec 29 '19 at 13:18
  • 2. Yes, this is the purpose of the stack check - if it's enabled you won't be able to exploit the potential overflow caused by gets. – macro_controller Dec 29 '19 at 13:19
1
  1. You can use checksec for dynamically linked binaries. However it'll fail for statically compiled binaries. You can try something like this for x86/64 with radare2
  • i386
$ r2 -AAA -qq -c "pdf @main~gs" test
│           0x00000591      658b0d140000.  mov ecx, dword gs:[0x14]
│           0x000005b6      65331d140000.  xor ebx, dword gs:[0x14]
  • amd64
$ r2 -AAA -qq -c "pdf @main~fs" test
│           0x00400b5c      64488b042528.  mov rax, qword fs:[0x28]
│           0x00400b85      644833142528.  xor rdx, qword fs:[0x28]

In x64 cookie is loaded from fs:[0x28] and in x86 from gs:[0x14] in the function prolog. You can refer to the answer here

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.